Recent updates to HIPAA’s Notice of Privacy Practices introduce new requirements related to substance use disorder (SUD) records that affect both Part 2 programs and other healthcare providers. While the regulatory changes are straightforward on paper, their operational impact varies depending on how organizations manage consent, disclosure, and record segmentation in practice. This post outlines what has changed and where providers may need to take a closer look.
Table of contents
Overview of the HIPAA NPP SUD Updates
A deadline (February 16, 2026) has come and gone for healthcare providers who are covered entities under the Health Insurance Portability and Privacy Act (HIPAA) to update their Notice of Privacy Practices (NPP) to comply with a regulation issued in 2024.
This update is required to advise patients of their rights to control the privacy of protected health information in a subset of patient records related to substance use disorders (SUD).
These new requirements affect some healthcare providers differently.
What This Means
HIPAA Notice of Privacy Practices for Part 2 Programs
Part 2 refers to a section of Title 42 of the U.S. Code addressing the confidentiality of patient records related to substance use disorders.
Part 2 programs are federally subsidized treatment programs for individuals with substance or alcohol use disorders.
Part 2 includes more stringent laws on the release of these records, particularly in relation to criminal investigations. Permissible disclosures were historically limited to patient consent or a court order.
The new notice provisions are mandatory for Part 2 programs. Organizations must revise patient consent documents and/or their Notice of Privacy Practices.
Key Requirements
Consent and Use of Records
- Allows use of a single consent for all future uses and disclosures for treatment, payment, and healthcare operations.
- A separate consent is required for:
- Disclosure for civil or criminal proceedings.
- Disclosure of counseling session notes.
Redisclosure
- HIPAA-covered entities and business associates that receive records under this consent may redisclose them in accordance with HIPAA regulations.
- SUD treatment records cannot be used in civil, criminal, or other official proceedings without patient consent or a court order.
Breach and Enforcement Alignment
- Applies HIPAA Breach Notification Rule requirements to Part 2 records.
- Provides for an accounting of disclosures as HIPAA regulations are updated.
- Standardizes criminal and civil penalties with HIPAA privacy rule regulations.
Investigative Agency Requirements
- Strengthens reasonable diligence requirements for investigative agencies.
- Requires checking SAMHSA’s treatment facility locator and a provider’s Notice of Privacy Practices before requesting records.
Counseling Notes
- Establishes a definition for SUD clinician notes maintained separately from the medical record.
- These notes require specific consent and cannot be disclosed under general consent.
- This is analogous to HIPAA protections for psychotherapy notes.
Changes to Consent Structure
- Consent for civil or criminal disclosure cannot be combined with consent for other purposes.
- Separate consent is required for disclosure of counseling session notes.
Changes to Privacy Practices Notices by Other Covered Health Care Providers
The new regulations also require other covered entities to revise their Notice of Privacy Practices to explain how SUD records may be protected or disclosed.
Key Requirements and Considerations
Patient Notification
- Inform patients that the organization is not a Part 2 program but may maintain records protected under federal law.
- Clarify that these records are handled differently.
Consent Requirements
- Written consent is required for use and disclosure of SUD treatment records.
- A single combined consent form may be used.
- Patients may revoke consent in writing (but previous disclosures are not retractable!).
Restrictions on Use
- SUD records cannot be used or disclosed for civil or criminal proceedings without written consent or a specific court order.
- A separate consent is required for the disclosure of counseling notes.
Patient Rights
- Patients may opt out of fundraising communications based on SUD records.
Permissible Disclosures
- SUD treatment records may be disclosed in medical emergencies or pursuant to a specific court order.
Operational Considerations
For most non-Part 2 healthcare providers, these changes should be manageable. However:
- Staff responsible for releasing records must understand the content of those records.
- Organizations should evaluate where SUD-related records are stored within electronic health record (EHR) systems.
- Records received from Part 2 providers should only be disclosed alongside other records if the patient has knowingly consented.
The new requirements simplify certain elements for Part 2 programs, but they also require action from non-Part 2 providers.